WARNING: Stat tracker hides a trojan horse virus

Storm Gang Turns Sights on NFL

BASINGSTOKE, UK - 10 September 2007 - A new outbreak of malicious spam emails targeting NFL fans has been launched against inboxes worldwide, according to email and Internet content security provider Marshal (www.marshal.com).

According to the Marshal TRACE Team, the latest Storm spam campaign has been timed to coincide with the start of the NFL season. The message lures recipients to a fake NFL website with the enticement of a 'Free NFL Game Tracker' - a utility that supposedly updates fans on game results but is actually the Storm trojan. Users are lured to download the tracker and by doing so download the trojan.

"This new campaign featuring the NFL tracker is not just designed to target ardent NFL fans but also to exploit the emerging popularity of Web-based Fantasy leagues," said Bradley Anstis, Director of Product Management at Marshal. "The Storm Gang are experts at manipulating the latest trends in Internet usage to lure unsuspecting Internet users into their traps, so their move to target the NFL and Fantasy leagues is not unexpected."
According to TRACE, the NFL Storm campaign accounts for 1 - 2 percent of all spam. The Storm Gang is responsible for up to 20 percent of all spam traffic worldwide - roughly equivalent to all the spam generated in the US on any given day. The scale of the botnet at the command of the Storm Gang is estimated to consist of anywhere between 1-5 million computers according to differing industry estimates.

"Of greatest concern is the frequency with which the Storm Gang is changing campaigns - currently they are changing them on a daily basis," said Anstis.

The Storm Gang launched three consecutive campaigns in three days leading into the weekend. Late last week, the Storm botnet was used to distribute a mass campaign targeting 'Tor' - a free downloadable that allows users to communicate anonymously over the Internet. The next day the spammers reverted back to the YouTube campaign, which first appeared two weeks ago. Then yesterday the NFL campaign was launched.

"Advanced spam filters should effectively block these messages as spam. However, we recommend the following advice to Web users," said Anstis.

1. Ensure that the security settings in your email client and Web browser are set to 'High'.

2. If you receive a message containing a link from a person you don't know, or haven't heard from for a long time, delete the message without opening it.

3. If you think you know who the message is from, look at the address of any web links very carefully. Be very suspicious of links that display as an IP address (numerical address) or that look similar to, but do not exactly match, the website address of any companies that you have dealings with. Don't click on the link in the message and don't click "OK" if it asks to download a file.

Further details and advice on the Storm Trojan can be found on Marshal's TRACE Center website http://www.marshal.com/trace/alertsitem.asp?article=294§ion=alerts

About Marshal
Marshal is a privately-owned company with its worldwide and EMEA headquarters at Basingstoke in the United Kingdom and regional offices in Paris (France), Munich (Germany), Johannesburg (South Africa), Houston (USA), Atlanta (USA), Sydney (Australia) and Auckland (New Zealand). Marshal is a global vendor of Comprehensive Secure Email and Internet Management solutions that integrate content filtering, compliance, secure messaging and archiving, to protect businesses against email and internet-based threats.

Forty per cent of the Global Fortune 500 companies use Marshal security solutions to secure their corporate messaging networks and web against internal abuse and external threats such as viruses, spam and malicious code. More than seven million users in 18,000 companies worldwide use Marshal's highly acclaimed MailMarshal and WebMarshal solutions to protect their networks, employees, business assets and corporate reputation and to comply with corporate governance legislation requirements.

For more information about Marshal visit http://www.marshal.com//

About TRACE
TRACE (Threat Research and Content Engineering) is a specialized team of Marshal security experts who monitor and respond to Internet security threats. The TRACE Team is tasked with analyzing the performance of Marshal solutions against Internet-borne threats. TRACE focus on a wide range of threats including spam, phishing, viruses and spyware.

The TRACE Team also engineers Marshal's response to threats, including maintaining security updates and detection technologies. TRACE is responsible for testing and issuing SpamCensor and Zero Day updates.

The TRACE Center is a sample of the data-gathering and technical analysis methods that Marshal employs. We will be adding additional statistics and new threat monitors over time so please check back regularly for news, information and new content.